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IN THE CLAIMS 

Please amend claims 19, 24, 41, 46, 65 and 70 as indicated below. 
The listing of claims will replace all prior versions, and listings, of claims in 
the application. 

Listing of Claims: 



1 Claim 1 (previously presented) A method for allowing a server node in a virtual 

2 private network to have a single tunnel definition and a single security policy for a 

3 plurality of tunnels associated with a group name comprising the steps of: 

4 configuring a group database in said server node, wherein said group database 

5 in said server node comprises said group name and a list of members associated with 

6 said group name; 

7 configuring a rules database in said server node, wherein said rules database 

8 associates said group name with a particular security policy, wherein said server node 

9 has a single security policy for each of the plurality of tunnels associated with said 

10 group name; 

1 1 establishing a tunnel having a tunnel definition between a client node having a 

12 member name and said server node by negotiating a common security policy; and 

13 associating said tunnel with a group in said group database based on said 

14 member name such that only one copy of said tunnel definition and associated 

15 security policy is maintained on said server node regardless of the number of client 

16 nodes to server node tunnels associated with said group. 

1 Claim 2 (original) The method as recited in claim 1 fiirther comprising the step of: 

2 configuring a tunnel definition database in said server node, wherein a remote 

3 ID in said tunnel definition is defined as said group name, wherein said server node 

4 has a single tunnel definition for each of the plurality of tunnels associated with said 

5 group name. 



Claims 3-4 (canceled) 
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1 Claim 5 (original) The method as recited in claim 1, wherein said list of members 

2 associated with said group name comprise an ID type and an ID of each member 

3 associated with said group name. 

1 Claim 6 (original) The method as recited in claim 5, wherein said ID type is an 

2 Internet Key Exchange (IKE) defined ID type, wherein said list of members is a 

3 non-contiguous hst of IKE defined ID types. 

1 Claim 7 (original) The method as recited in claim 5, wherein said ID is a login ID. 

1 Claim 8 (original) The method as recited in claim 5, wherein said ID is a specified 

2 name. 

1 Claim 9 (previously presented) The method as recited in claim 2, wherein 

2 configuring said tunnel definition database in said server node comprises estabUshing 

3 said server node and said client node as the two end points of said tunnel. 

1 Claim 10 (original) The method as recited in claim 9, wherein said tunnel definition 

2 database in said server node is configured by a user entering a local ID, a local ID 

3 type, said remote ID and a remote ID type through a GUI. 

1 Claim 11 (original) The method as recited in claim 9, wherein said tunnel definition 

2 database in said server node is configured by a user entering a local ID, a local ID 

3 type, said remote ID and a remote ID type through a command line interface. 

1 Claim 12 (original) The method as recited in claim 1, wherein said group database in 

2 said server node comprises said group name and an ID type of each member of said 

3 group name and an ED of each member of said group name. 

1 Claim 13 (original) The method as recited in claim 12, wherein configuring said 

2 group database in said server node is accomplished by entering said group name, said 

3 ID type of each member of said group name and said ID of each member of said 

4 group name through a GUI. 
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1 Claim 14 (original) The method as recited in claim 12, wherein configuring said 

2 group database in said server node is accomplished by entering said group name, said 

3 ID type of each member of said group name and said ID of each member of said 

4 group name through a command line interface. 

1 Claim 15 (original) The method as recited in claim 12, wherein configuring said 

2 group database in said server node is accomplished by entering said group name, said 

3 ID type of each member of said group name and said ID of each member of said 

4 group name through configuration files. 

1 Claim 16 (original) The method as recited in claim 1 , wherein said rules database in 

2 said server node comprises said group name, a group name ID type and a security 

3 policy pointer. 

1 Claim 17 (original) The method as recited in claim 16, wherein configuring said 

2 rules database in said server node is accomplished by entering said group name, said 

3 group name ID type and said security policy pointer through a GUI. 

1 Claim 18 (original) The method as recited in claim 16, wherein configuring said 

2 rules database in said server node is accomplished by entering said group name, said 

3 group name ID type and said security poUcy pointer through a command line 

4 interface. 

1 Claim 19 (currently amended) The method as rocitcd in claim 1 further comprising 

2 the atop of: A method for allowing a server node in a virtual private network to have 

3 a single tunnel Hefinition and a single securitv policy for a plurality of tunnels 

4 associated with a group na me comprising the steps of: 

5 configuring a g rou p database in said server n od e , wh erein s aid ^roup database 

6 in said server node comprises sai d proun name and a list of members associated with 

7 said group name; 

g ronfiguring a rules database i n said server node, wherein said rules database 

9 .ssndates said grou p name with a p artirnlar securitv policy wherein said server node 
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10 i,.c . .in.1. .ecuritv t^olicv fj h nf thn plnnlit^^ of ti.nnHs associated with said 

11 group name; 
.ct.^lkhmp a tunnel ^^^'^- ^ - tnnnel defitiition between a client node having a 

.nrl .Rid serv pr .nHP hv negotiating ^ common security policy; 
.ce».^.t;n p ..id tunnel wUl. . prnnn in snid mnp database based on said 
..r.. th.t only o n. ropy of said tunnH definition and associated 
c...,dtv policy is ma ^ -t.^..H on said server node regardless of the number of client 
17 nodes to server mde tunnels associated wit h said group; and 

activating said tumiel, wherein activating said tunnel comprises the steps of: 

sending a security poHcy stored in a poUcy database of said client node 

20 by said client node to said server node; 

21 sending a security policy stored in a policy database of said server 

22 node by said server node to said client node if said security policy stored in said 

23 pohcy database of said server node matches said security policy stored in said policy 

24 database of said client node; 

25 sending a first nonce by said client node to said server node; 

sending a second nonce by said server node to said cUent node; 
sending a first E) by said chent node to said server node; and 
sending a second ID by said server node to said client node. 

1 Claim 20 (original) The method as recited in claim 19, wherein said first and second 

2 nonce are used to generate key material for said server and client node, respectively. 

1 Claim 21 (original) The method as recited in claim 19, wherein said policy database 

2 in said cUent and server node are configured by entering said security policy through 

3 a GUI at said client and server node. 

1 Claim 22 (original) The method as recited in claim 19, wherein said policy database 

2 in said chent and server node are configured by entering said security pohcy through 

3 a command line interface at said client and server node. 

1 Claim 23 (original) The method as recited in claim 19, wherein said first ID is an ID 

2 of said particular member of said group name. 



26 
27 
28 



5 



AUS9-2000-0479-US1 



PATENT 



1 Claim 24 (currently amended) The mothod ao recited in claim 1 further comprisinc 

2 thcctcpof: A method for allnwing a server n od e in a virtua l p rivate network to have 

3 . .male timnel d efinition and a sin ple s ec urity policy for a plurality of tunnels 

4 associated wit h a group nam e comprising the steps of: 

5 mnfi puring a gr ou p database in said server node, wherein said proup database 

6 in ..iH .erver node r-om prises said gro up nam e and a list of members associated with 

7 said group name; 

8 rnnfi guring a rules database in s aid server node, wherein said rules database 

9 ...nriates said grou p name with a n ^rfirnlar security noliov, wherein said server node 

10 h.. a single securi t y pohr.v for each of the plurality of tunnels associated with said 

11 group name; 

12 Pstahhshing a tu nnel having a tunn el definition between a client node having a 

13 member name apH said server nod e bv negotiating a common security policy; 

14 assnriatipg said timnel with a gr oup in s a id g roup database based on said 

15 member name su ch that onlv one c opy of said tumiel definition and associated 

16 sernritv pohcv i« maintained on s airl server node regardless of the number of client 

17 nodes to server node tunnels associated with said group; and 

1 8 activating said tunnel, wherein activating tunnel comprises the steps of: 

19 sending a securitypohcy stored in apolicy database of said client node 

20 by said client node to said server node; 

21 sending a security policy stored in a poUcy database of said servei 

22 node by said server node to said client node if said security pohcy stored in saic 

23 poUcy database of said server node agrees on the same set of protection suites at an> 

24 point in time with said security policy stored in said policy database of said clien 

25 node; 

26 sending a first nonce by said client node to said server node; 

27 sending a second nonce by said server node to said client node; 

28 sending a first ID by said client node to said server node; and 

29 sending a second ID by said server node to said cUent node. 
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1 Claim 25 (original) A network system comprising: 

2 a plurality of tunnels associated with a group name, wherein each of said 

3 plurality of tunnels associated with said group name comprises a plurality of nodes, 

4 wherein each of said plurality of nodes comprises a commimication adapter to 

5 interconnect with said virtual private network, wherein one of said plurality of nodes 

6 is a server node, wherein one of said plurality of nodes is a client node, wherein said 

7 server node comprises: 

8 a group database, wherein said group database comprises said group 

9 name and a list of members associated with said group name; and 

10 a rules database, wherein said rules database associates said group 

1 1 name with a particular security policy, wherein said server node has a single security 

12 poUcy for each of the plurality of tunnels associated with said group name. 

1 Claim 26 (original) The network system as recited in claim 25, wherein said server 

2 node further comprises: 

3 a tunnel definition database, wherein a remote ID in said tunnel definition is 

4 defined as said group name, wherein said server node has a single tunnel definition 

5 for each of the plurality of tunnels associated with said group name. 

1 Claim 27 (original) The network system as recited in claim 26, wherein a particular 

2 tunnel of said plurality of tunnels associated with said group name is activated, 

3 wherein said particular tunnel is associated with a particular member of said group 

4 name. 

1 Claim 28 (original) The network system as recited in claim 25, wherein said list of 

2 members associated with said group name comprise an ID type and an ID of each 

3 member associated with said group name. 

1 Claim 29 (original) The network system as recited in claim 28, wherein said ID type 

2 is an Internet Key Exchange (IKE) defined ID type, wherein said list of members is a 

3 non-contiguous list of IKE defined ID types. 
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Claim 30 (original) The network system as recited in claim 28, wherein said ID is a 
login ED. 

Claim 31 (original) The network system as recited in claim 28, wherein said ID is a 
specified name. 

Claim 32 (original) The network system as recited in claim 26, wherein said tunnel 
definition database in said server node is configured by a user entering a local ID, a 
local H) type, said remote ID and a remote ID type through a GUI. : 

Claim 33 (original) The network system as recited in claim 26, wherein said tunnel 
definition database in said server node is configured by a user entering a local ID, a 
local ID type, said remote ID and a remote ID type through a command Une interface. 

Claim 34 (original) The network system as recited in claim 25, wherein said group 
database in said server node comprises said group name and an ID type of each 
member of said group name and an ID of each member of said group name. 

Claim 35 (original) The network system as recited in claim 34, wherein said group 
database in said server node is configured by a user entering said group name, said ID 
type of each member of said group name and said ID of each member of said group 
name through a GUI. 

Claim 36 (original) The network system as recited in claim 34, wherein said group 
database in said server node is configured by a user entering said group name, said ID 
type of each member of said group name and said ID of each member of said group 
name through a command line interface. 

Claim 37 (original) The network system as recited in claim 34, wherein said group 
database in said server node is configured by a user entering said group name, said ID 
type of each member of said group name and said ID of each member of said group 
name through configuration files. 
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1 Claim 38 (original) The network system as recited in claim 25, wherein said rules 

2 database in said server node comprises said group name, a group name ID type and a 

3 security policy pointer. 

1 Claim 39 (original) The network system as recited in claim 38, wherein said rules 

2 database is configured by a user entering said group name, said group name ID type 

3 and said security poUcy pointer through a GUI. 

1 Claim 40 (original) The network system as recited in claim 39, wherein said rules 

2 database is configured by a user entering said group name, said group name ID type 

3 and said security policy pointer through a command line interface. 

1 Claim 41 (currently amended) The network oyotom ao rocitod in claim 27, A network 

2 system comprising: 

3 a plurality of tunnels associated with a group name, w herein each of said 

4 plurality of tunnels associated with said group name comprise s a plurality of nodes, 

5 wherein each of said plurality of nodes comprises a communication adapter to 

6 interconnect with said virtual private network, wherein one of said plurality of nodes 

7 is a server node, wherein one of said plurality of nodes is a cli ent node, wherein said 

8 server node comprises: 

9 a group database, wherein said group databas e comprises said group 

10 name and a list of members associated with said group na me: and 

11 a rules database, wherein said rules database associates said group 

12 name with a particular security poUcv. wherein said server n ode has a single security 

13 policy for each of the plurality of tunnels associat ed with said group name; 

14 wherein said server node further comprises: 

15 a tunnel definition database, wherein a remo te ID in said tunnel 

16 definition is defined as said group name, wherein said server node has a single tunnel 

17 definition for each of the plurality of tunnels associated with said group name; 

18 wherein a particular tunnel of said plurality of t unnels associated with said 

19 group name is activated, wherein said particular tunnel is a ssociated with a particular 

20 member of said group name; 
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2 1 wherein activating said particular tunnel comprises the steps of: 

22 sending a security policy stored in a policy database of said client node 

23 by said client node to said server node; 

24 sending a security poUcy stored in a policy database of said server 

25 node by said server node to said client node if said security policy stored in said 

26 poUcy database of said server node matches said security poHcy stored in said policy 

27 database of said client node; 

28 sending a first nonce by said client node to said server node; 

29 sending a second nonce by said server node to said client node; 

30 sending a first ID by said cUent node to said server node; and 

3 1 sending a second ID by said server node to said client node. 

1 Claim 42 (original) The network system as recited in claim 41 , wherein said first and 

2 second nonce are used to generate key material for said server and chent node, 

3 respectively. 

1 Claim 43 (original) The network system as recited in claim 41, wherein said poUcy 

2 database in said client and server node are configured by entering said security policy 

3 through a GUI at said client and server node. 

1 Claim 44 (original) The network system as recited in claim 41, wherein said policy 

2 database in said chent and server node are configured by entering said security policy 

3 through a command line interface at said client and server node. 

1 Claim 45 (original) The network system as recited in claim 41, wherein said first ID 

2 is an ID of said particular member of said group name. 

1 Claim 46 (currently amended) Tho network oyotom ao recited in claim 27, A network 

2 svstem comprising: 

3 a plurality of tunnels associated with a group name, wherein each of said 

4 plurality of tunnels associated with said group n ame comprises a plurality of nodes, 

5 wherein each of said plurality of nodes compris es a communication adapter to 

6 interconnect with said virtual private network, w herein one of said plurality of nodes 

10 



AUS9-2000-0479-US1 



PATENT 



7 is a server node, wherein one of said plurality of no des is a client node, wherein said 

8 server node comprises: 

9 a group database, wherein said group database c omprises said group 

10 name and a list of members associated with sai d group name: and 

11 a rules database, wherein said rules database associates said group 

12 name with a particular security policy, wherein said server node has a single security 

13 policy for each of the plurality of tunnels associa ted with said group name; 

14 wherein said server node further comprises: 

15 a tunnel definition database, wherein a remote ID in said tunnel 

16 definition is defined as said group name, wherein sa id server node has a single tunnel 

17 definition for each of the plurality of tunnels assoc iated with said group name; 

18 wherein a particular tunnel of said plurality of t unnels associated with said 

19 group name is activated, wherein said particular tunnel is as sociated with a particular 

20 member of said group name; 

21 wherein activating said particular tunnel comprises the steps of: 

22 sending a security policy stored in a policy database of said client node 

23 by said client node to said server node; 

24 sending a security policy stored in a poUcy database of said server 

25 node by said server node to said client node if said security policy stored in said 

26 policy database of said server node agrees on the same set of protection suites at any 

27 point in time with said security poHcy stored in said policy database of said client 

28 node; 

29 sending a first nonce by said client node to said server node; 

30 sending a second nonce by said server node to said client node; 

3 1 sending a first ID by said client node to said server node; and 

32 sending a second ID by said server node to said client node. 

1 Claim 47 (previously presented) A computer program product having a computer 

2 readable medium having computer program logic recorded thereon for allowing a 

3 server node in a virtual private network to have a single tunnel definition and a single 

4 security policy for a plurality of tunnels associated with a group name, comprising: 
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5 programming operable for configuring a group database in said server node, 

6 wherein said group database in said server node comprises said group name and a list 

7 of members associated v/iih said group name; 

8 programming operable for configuring a rules database in said server node, 

9 wherein said rules database associates said group name with a particular security 

10 policy, wherein said server node has a single security policy for each of the plurality 

1 1 of tunnels associated with said group name; 

12 programming operable for establishing a tunnel having a tunnel definition 

13 between a client node having a member name and said server node by negotiating a 

14 common security policy; and 

15 programming operable for associating said tunnel with a group in said group 

16 database based on said member name such that only one copy of said tunnel 

17 definition and associated security policy is maintained on said server node regardless 

18 of the number of client nodes to server node tunnels associated with said group. 

1 ~ Claim 48 (original) The computer program product as recited in claim 47 fiirther 

2 comprises: 

3 programming operable for configuring a tunnel definition database in said 

4 server node, wherein a remote ID in said tunnel definition is defined as said group 

5 name, wherein said server node has a single tunnel definition for each of the plurahty 

6 of tunnels associated with said group name. 

Claims 49-50 (canceled) 

1 Claim 51 (original) The computer program product as recited in claim 47, wherein 

2 said list of members associated with said group name comprise an ID type and an ID 

3 of each member associated with said group name. 

1 Claim 52 (original) The computer program product as recited in claim 51, wherein 

2 said ID type is an Intemet Key Exchange (IKE) defined ID type, wherein said list of 

3 members is a non-contiguous list of IKE defined ID types. 
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Claim 53 (original) The computer program product as recited in claim 51, wherein 
said ID is a login ID. 

Claim 54 (original) The computer program product as recited in claim 51, wherein 

t 

said ID is a specified name. 

Claim 55 (previously presented) The computer program product as recited in claim 
48, wherein configuring said tunnel definition database in said server node comprises: 
programming operable for establishing said server node and said client node 
as the two end points of said tunnel. 

Claim 56 (original) The computer program product as recited in claim 55, wherein 
said tunnel definition database in said server node is configured by a user entering a 
local ID, a local ID type, said remote ID and a remote ID type through a GUI. 

Claim 57 (original) The computer program product as recited in claim 55, wherein 
said tunnel definition database in said server node is configured by a user entering a 
local ID, a local ID type, said remote ID and a remote ID type through a command 
Urie interface. 

Claim 58 (original) The computer program product as recited in claim 47, wherein 
said group database in said server node comprises said group name and an ID type of 
each member of said group name and an ID of each member of said group name. 

Claim 59 (original) The computer program product as recited in claim 58, wherein 
configuring said group database in said server node is accomplished by entering said 
group name, said ID type" of each member of said group name and said ID of each 
member of said group name through a GUI. 

Claim 60 (original) The computer program product as recited in claim 58, wherein 
configuring said group database in said server node is accomplished by entering said 
group name, said ID type of each member of said group name and said ID of each 
member of said group name through a command line interface. 
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1 Claim 61 (original) The computer program product as recited in claim 58, wherein 

2 configuring said group database in said server node is accomplished by entering said 

3 group name, said ID type of each member of said group name and said ID of each 

4 member of said group name through configuration files. 

1 Claim 62 (original) The computer program product as recited in claim 47, wherein 

2 said rules database in said server node comprises said group name, a group name ID 

3 type and a security policy pointer. 

1 Claim 63 (original) The computer program product as recited in claim 62, wherein 

2 configuring said rules database in said server node is accomplished by entering said 

3 group name, said group name ED type and said security policy pointer through a GUI. 

1 Claim 64 (original) The computer program product as recited in claim 62, wherein 

2 configuring said rules database in said server node is accomplished by entering said 

3 group name, said group name ID type and said security policy pointer through a 

4 command line interface. 

1 Claim 65 (currently amended) Th e comput e r program product as r e cit e d in claim 4 7 

2 furth e r comprising: A computer program product having a computer readable 

3 medium having computer program logic recorded thereon for allowing a server node 

4 in a virtual private network to have a single tunnel definition and a single security 

5 policy for a plurality of tunnels associated with a group name, comprising: 

6 programming operable for configxuing a group database in said server node. 

7 wherein said group database in said server node comprises said group name and a list 

8 of members associated with said group name; 

9 programming operable for configuring a rules database in said server node, 

10 wherein said rules database associates said group name with a particular security 

11 policy, wherein said server node has a single security policy for each of the plurality 

12 of tunnels associated with said group name; 
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13 progranuning operable for establishing a tunnel h aving a tunnel definition 

14 between a chent node having a member name and said server node by negotiating a 

15 common security policy; 

16 programming operable for associating s aid tunnel with a group in said group 

17 database based on said member name such that only one copy of said tunnel 

18 defmition and associated security policy is maintained on said server node regardless 

19 of the number of cUent nodes to server node tunnel s associated with said group; and 

20 programming operable for activating said tunnel, wherein said programming 

21 operable for activating said tunnel comprises: 

22 programming operable for sending a security policy stored in a policy 

23 database of said client node by said client node to said server node; 

24 programming operable for sending a security policy stored in a poUcy 

25 database of said server node by said server node to said client node if said security 

26 poUcy stored in said policy database of said server node matches said security policy 

27 stored in said policy database of said chent node; 

28 programming operable for sending a first nonce by said client node to 

29 said server node; 

30 programming operable for sending a second nonce by said server node 

31 to said client node; 

32 programming operable for sending a fu-st ID by said client node to said 

33 server node; and 

34 programming operable for sending a second ID by said server node to 

35 said client node. 

1 Claim 66 (original) The computer program product as recited in claim 65, wherein 

2 said first and second nonce are used to generate key material for said server and client 

3 node, respectively. 

1 Claim 67 (original) The computer program product as recited in claim 65, wherein 

2 said policy database in said chent and server node are configured by entering said 

3 security policy through a GUI at said chent and server node. 
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1 Claim 68 (original) The computer program product as recited in claim 65, wherein 

2 said poUcy database in said client and server node are configured by entering said 

3 security policy through a command line interface at said client and server node. 

1 Claim 69 (original) The computer program product as recited in claim 65, wherein 

2 said first ID is an ID of said particular member of said group name. 

1 Claim 70 (currently amended) The computer program product ao rocitod in claim ^7 

2 fiuthor comprioing: A computer p rogram product having a computer readable 

3 medium having computer program logic re c orded thereon for allowing a server node 

4 in a virtual private network to have a si n gle tunnel definition and a single security 

5 policy for a plurahtv of tunnels associate d with a group name, comprising: 

6 programming o perable for configuring a g roup database in said server node, 

7 wherein said g rou p database in said server node comprises said group name and a list 

8 of members associated with said g roup name; 

9 programming operable for configuring a rules database in said server node, 

10 wherein said rules database associates sai d group name with a particular security 

11 policv. wherein said server node has a sing l e security policy for each of the plurality 

12 of tunnels associated with said gr oup name; 

13 programming operable for estabhshin g a tunnel having a tunnel definition 

14 between a chent node havinp a member n ame and said server node by negotiating a 

15 common security policv; 

16 programming operable for associating said tunnel with a group in sa id group 

17 database based on said member name suc h that only one copy of said tiumel 

18 definition and associated security policv i s maintained on said server node regardless 

19 of the number of client nodes to server node tunnels associated with said group; and 

20 programming operable for activating said tunnel, wherein said programming 

21 operable for activating said tunnel comprises: 

22 programming operable for sending a security poUcy stored in a policy 

23 database of said client node by said cUent node to said server node; 
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programming operable for sending a security policy stored in a policy 
database of said server node by said server node to said client node if said security 
policy stored in said policy database of said server node agrees on the same set of 
protection suites at any point in time with said security policy stored in said poUcy 

database of said client node; 

programming operable for sending a first nonce by said client node to 

said server node; 

programming operable for sending a second nonce by said server node 

to said client node; 

programming operable for sending a first ID by said client node to said 

server node; and 

programming operable for sending a second ID by said server node to 
said client node. 
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